CVE-2026-50277
- Source
- https://cve.org/CVERecord?id=CVE-2026-50277
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50277.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-50277
- Aliases
-
- GHSA-ch7h-phmx-rqwq
- Published
- 2026-09-17T20:16:37Z
- Modified
- 2026-09-19T08:14:26Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS
- Details
-
dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very large value, causing per-request hash-map allocation and unbounded CPU and memory consumption. Baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, so affected internet-facing services can be denied service. This issue is fixed in version 2.1.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-770" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50277.json" }- References
-
- https://github.com/DataDog/dd-trace-cpp/releases/tag/v2.1.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50277.json
- https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-ch7h-phmx-rqwq
- https://nvd.nist.gov/vuln/detail/CVE-2026-50277
- https://github.com/DataDog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666
- https://github.com/DataDog/dd-trace-cpp/pull/313
Affected packages
Git / github.com/datadog/dd-trace-cpp
Affected versions
v0.*
v0.1.0
v0.1.1
v0.1.10
v0.1.11
v0.1.12
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.2.0
v0.2.1
v0.2.2
v1.*
v1.0.0
v2.*
v2.0.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50277.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "224479716267846172300669952024393856607",
"length": 576
},
"id": "CVE-2026-50277-013fa94a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "src/datadog/tracer.cpp",
"function": "Tracer::extract_baggage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "266132350467458871403181516730065194836",
"length": 829
},
"id": "CVE-2026-50277-246ba025",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541",
"target": {
"file": "src/datadog/trace_segment.cpp",
"function": "TraceSegment::make_sampling_decision_if_null"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"85205526672945050702103165735692613339",
"217932444524702398203590216791177261845",
"138257647346547042677017042117157701343",
"284733783213817760575518320260611721614",
"230221863654289187088705673984214270463",
"108587633537507210242609878158511307392",
"166562729874665529044791448594841845879",
"250318724918239863406315277729419840635",
"141820254050139657803633893699962041143",
"337949160333293935851424666620361318134",
"196312749931560883608386023052686035533",
"154631684564252420157893585231365155737",
"313448949655180564010973989122600442320",
"299858224066908807181824517043898310524",
"30010691778295181884299438050046188928",
"126106594443245104774750970396568568984",
"104169346869990079121562388850364265267",
"215026970037981025906212150417669814885",
"207856770746052281964008810459578639309",
"133082035636541680982180752935704674842",
"42569621367742354669769612689991352791",
"36052307541049860791887339599248465812",
"244474608711493247444175456797355145725",
"139841534153349272477787002742904667341",
"57588092190634299082344892320779110333",
"246298178125313530949497452470099720887",
"227133364493520014580506981498460916327"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-27a0b958",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541",
"target": {
"file": "src/datadog/trace_segment.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"200484139372890239760378008461073702468",
"211526129731435034692768618950522690353",
"192382464883828658406268978865836403789",
"91867275185150755406262696129947824811",
"301506281495705383114850107997796520275",
"195473780079535026175498186238658799427",
"16335844807748973021171374372340370858",
"96041772745963263508520038422754658207"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-344c62c0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541",
"target": {
"file": "test/test_trace_segment.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"159651601263021419263654684983416319718",
"52262735322077478522312991233557285938",
"84541050633726552818264863705199950511",
"105254968638279188734891742666817977608",
"274936128515996365398147868047039475538",
"108587633537507210242609878158511307392",
"268006568146430569581215389817049643614"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-34f23d22",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "test/test_tracer.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"104162021934632812242804113200542334891",
"146679231008598244416816940305462705411",
"283176437196917362741878973138773717896",
"229214866727964981947905635657256307001",
"157763728101060601013417926522756686804",
"232947747528079841230929071317366885371",
"327219894532985620841477320707411364472",
"249536680391366858348506658730551869904",
"253927373574784304560858477580444637675",
"63062536652791254781716535157264029526",
"187491089232925346868203540009949367045",
"110803466745383675688071914320705861192",
"40237879949430338642596253868964799179",
"67754073654403281123624511290486655112"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-3753a528",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "test/test_trace_segment.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"105613664600482121504959646489580717361",
"131056707175541226960767445262429703885",
"93433526158033273365097876697507329439",
"75223489136400023289009831262044638486"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-41ebcacb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541",
"target": {
"file": "include/datadog/version.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"223149217427653476650641915890500954342",
"287293014278599225291121618483169901483",
"34860673376011095884324302672848039591",
"36011255611162508908289989583855590910"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-4e52289e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "include/datadog/baggage.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"26639510820851854839800887051813200168",
"57593032458079180178519604593228862564",
"304660887562709851099342648645280572775",
"129992566206783704027697317368241388288",
"102516503055350713628704010399963440007"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-5e2be9c8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541",
"target": {
"file": "src/datadog/version.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"156049907992563847372448269071408353675",
"191474336665296801096795513886498672903",
"64778751313588164570375910894514750054",
"71323694874574242046173711945662795558"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-6d1f368f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "src/datadog/tracer.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"68492631196957930185837915469096386614",
"168507825181607500348837005332212982359",
"241962131681022930778979852842192348312",
"334076304336273605260156422568362442561",
"294457367243370323199480894529901784729",
"38261828991320048906732014511339589262",
"310251191590670796241628268999787510130",
"281788044779721876173524135706599585436",
"13197533497422051986593185596802656189",
"26121670259560863816429389752036914462",
"217709937183521914895706268878121177024",
"298504102867983686180410577832008491390",
"277122708944163363358480863208728804830",
"216382020102487272547505309422720944315",
"260529276054893427066173129555657158054",
"261101148370560045745696552948664056219",
"186842775373940939022063941748900863950",
"335269598353153162839590933952629265522",
"126478341219269246620618028357245322556",
"141158824319894339262411011521858808655",
"158411602857567976600202839299475155840",
"237218251746389582507073095460825883634",
"154486679274149931753277171443793214320",
"29979600683402918289269491405062699833",
"177638623129376437738982253369227438262",
"144012126488593976559673752960630878952",
"250898855018885663233820841577309056315",
"243915166580458329614994063231383186595",
"28032369941419596162611671121748243630",
"75165913535536121673205408333514817353",
"70344531447879445923988377004311047213",
"72890336460548282136548701528394895522",
"250803113763337715096162007210545324100",
"11423171170957600994250636653281279082",
"9753280904342403714017120438649859730"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-7103278f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "src/datadog/baggage.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "107099478987533353180109564085331057489",
"length": 537
},
"id": "CVE-2026-50277-9016c506",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "src/datadog/w3c_propagation.cpp",
"function": "extract_tracestate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"127673964837931770327047682516563228265",
"322655099510793347177064694659456044472",
"121605486081983305001896630946771570662",
"54105043811352513759759477456110313007"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-ba8b5329",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "src/datadog/extraction_util.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "293560209042559291315995340571765651667",
"length": 2923
},
"id": "CVE-2026-50277-c67fd1bf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "src/datadog/baggage.cpp",
"function": "parse_baggage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "304842661891554424357766059542028388994",
"length": 281
},
"id": "CVE-2026-50277-cbb26a53",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "src/datadog/baggage.cpp",
"function": "Baggage::extract"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"197555705105413861768283091323362145311",
"25314519238787370653731226925776283092",
"157991875332229184021791245986804475248",
"123442669274281144842916633327488808540"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-cc9300ec",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "test/test_baggage.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"201159436115795120775320885628054351194",
"298067269043124223976657605963096354713",
"245412528634261233046995308983875773733",
"160732898208425170299339232146962905023",
"201279199425233646291385469658458786783",
"63875229341819944322706741701001081122",
"162683187970176517870382012345328235982",
"165868847768045429144281016341350502421",
"247086581314649410405093944834150077215",
"266762780906562514383651583164767950743",
"46593207362876291970340878246657502137"
],
"threshold": 0.9
},
"id": "CVE-2026-50277-e7e05e6c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"target": {
"file": "src/datadog/w3c_propagation.cpp"
}
}
]
vanir_signatures_modified
"2026-09-19T08:14:26Z"